Daniel is in term of positions, not bytes Luca
On Apr 12, 2011, at 5:43 PM, Daniel Aschwanden wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > Hi all, > > Just another small question about the hash size of nprobe: > > Is this size in terms of "buckets" (positions) or in terms of bytes/bits? > > It would be just good to know to do some basic consideration. > > Regards, > Daniel > >> Hi all, >> let me explain this in detail. >> >> A hash is a contiguous array of list pointers. Incoming flows are hashed >> (using >> the 5 tuples) and the obtained hash_id value is used to identify the array >> index. As hashes are a way to "compress" information, it might happen that >> two >> different flows have the same hash_id, thus the list pointer is used to >> maintain a list of "collisions". With -w you set the array size, whereas the >> list size can be as long as necessary. This said, in order to set an upper >> limit, nprobe via >> >> [--max-num-flows|-M] <max num flows>| Limit the number of active flows >> >> defines the max number of flows it can handle >> >> This said, you must choose -w according to the number of flows you expect to >> have in your network. The value must be a good compromise between number of >> flows and memory usage. We suggest to set it to twice the expected number of >> concurrent flows, but as I have explained it, in case of large flow number, >> you >> won't drop flows (except you will specify a low value for -M) but just have >> a >> slower probe as it has to maintain long collision lists. If you start nprobe >> with "-b 1" you can see some stats like >> >> 13/Mar/2011 11:30:13 [nprobe.c:1475] Flow Buckets: >> [active=11401][allocated=11401][toBeExported=0][frags=0] >> 13/Mar/2011 11:30:13 [nprobe.c:1511] Processed packets: 24834 (max bucket >> search: 3) >> >> In this case nProbe says that >> 1. your flow cache has 11401 entries (= flows) >> 2. the longest collision list is 3 that's still acceptable. If you exceed 8, >> you better use a bigger value for -w next time you start nProbe. >> >> I hope I have clarified the details. >> >> Regards Luca >> >> On Mar 10, 2011, at 11:31 AM, Maurizio Molina wrote: >> >>> >>> >>> On 10.03.2011 11:16, Yuri Francalacci wrote: >>>> Daniel >>>> the meaning of "hash size is static" means that once you decide its size, >>>> this size is fixed. >>>> The meaning of "tunable" means that is the default hash size does not fit >>>> your requirements (due traffic conditions), >>> >>> and how can you realize that you run into that condition? I mean, will >>> nprobe >>> log somewhere flow accounting losses due to a too small hash size? >>> Thanks, >>> Maurizio >>> >>> you can choose to set the size >>>> you prefer/need, but this allocation is done up on nprobe statup. >>>> Regards, Yuri >>>> >>>> >>>> On Thu, 10 Mar 2011 11:12:15 +0100, Daniel Aschwanden<[email protected]> wrote: >>>>> Ciao Luca and community, >>>>> >>>>> I have a question about the allocation of the hash in nProbe. >>>>> >>>>> On page 28 of your documentation (section 2.4 Tuning nProbe >>>>> Performance), you state that the hash size is static, but on the >>>>> footnote you mention that the hash "can grow as needed according to >>>>> traffic". Does this mean that one have to set the -w flag according to >>>>> the traffic (which makes sense) or does nProbe grow his hash according >>>>> to traffic? >>>>> >>>>> Sorry about this fuzzy question, but in my eyes the footnote contradicts >>>>> the statement of static allocation. >>>>> >>>>> Thanks a lot for your clarification. >>>>> >>>>> Cheers >>>>> >>>>> Dani >>>>> _______________________________________________ >>>>> Ntop-misc mailing list >>>>> [email protected] >>>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>>> >>> >>> -- >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >> >> --- >> Due to lack of interest, tomorrow is cancelled - Kaiser Chiefs >> >> >> _______________________________________________ >> Ntop-misc mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > - -- > daniel aschwanden > junior engineer > > open systems ag > raeffelstrasse 29 > ch-8045 zurich > t: +41 44 455 74 00 > f: +41 44 455 74 01 > [email protected] > > http://www.open.ch > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.10 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > iF4EAREIAAYFAk2kczgACgkQxIzmH53Qg6GtkAD/RKcAvnEGn0jCh59dKXOXrZPN > QJ4CvSad+uTJg+k2ZRQA/0Aw8KBZRA3QZaS1cEmHldM8CrMbfLQr1CjOvDJ+Ww7R > =flaW > -----END PGP SIGNATURE----- > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc --- If you can not measure it, you can not improve it - Lord Kelvin _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
